NTP (Network Time Protocol)
PCIComplianceHubLast updated
A protocol used to synchronize the clocks of computers and devices over a network. Accurate timekeeping is important for activities such as logging and monitoring, which are required by PCI DSS to ensure the security and integrity of cardholder data environments.
Applies to. 10.6.1 requires system clocks and time to be synchronised using time-synchronisation technology, and its guidance names NTP as the example. 10.6.2 spells out the shape: one or more designated central time servers, only those servers taking time from outside, external time based on International Atomic Time or UTC, and internal systems taking time only from the designated servers. Those internal systems are every in-scope component that writes an audit log, because 10.2.2 requires each log entry to carry a date and time that can be relied on. The standard's scoping section also lists NTP servers among the server types that count as system components, so the time server itself is in scope.
Example. A merchant runs two internal time servers that peer with each other and pull time from a small set of approved external sources. Every POS controller, database and firewall in the CDE takes time only from those two. When the assessor lines up a firewall log against a database log during an incident review, the timestamps agree, which is the whole point of 10.6.2.
Limits. PCI DSS does not require NTP by name. It requires correct and consistent time from designated sources; NTP is the usual protocol, but whatever meets 10.6.2 will do. Running NTP is not enough on its own: a server that also accepts time from any internet source, or a workstation that syncs to a public pool directly instead of the internal servers, breaks the rule that internal systems take time only from the designated servers. Time synchronisation also makes logs consistent in timestamp, not in content; what each log must record is 10.2.2's job.